Privacy Policy

1.1 Information you provide directly

We collect information you choose to give us when you:

• Send an enquiry through the form on the Website (hosted by Tally) — your name, email address, the option you selected (for example the programme you are interested in), and the content of your message;
• Subscribe to our newsletter (hosted by beehiiv) — your name and email address;
• Register for, or take part in, a programme, session, workshop or event — registration details such as name, email address, telephone number, school or organisation, and, for a learner, the learner's name and age group as provided by a parent, guardian or institution;
• Engage us for services — billing name, address, GSTIN where applicable, and the details needed to raise an invoice and receive payment (payment card details are handled by the payment provider, never stored by us);
• Communicate with us by email, telephone, WhatsApp or social media — the content of that communication.

1.2 Information collected automatically

When you use the Website, our hosting provider's servers record standard technical information such as IP address, approximate location (country or city), browser type and version, operating system, device type, the pages you visit, the referring page and the date and time of your visit. Embedded third-party content (see section 4) may collect similar information according to its own policies, and only where you have allowed it.

1.3 Information from third parties

We may receive information about you from a school, organisation or parent that engages us on your behalf, or from a platform you have used to contact us (for example Instagram or LinkedIn). Where we do, we handle it under this Policy.

1.4 Children

Under the Digital Personal Data Protection Act, 2023 a child is any person under the age of 18. The Website is not directed at children and we do not knowingly collect personal data directly from them. Our programmes are used by learners, including children, but all registrations, enquiries and transactions are made by a parent, legal guardian or educational institution, who provides any learner details on the child's behalf and gives the verifiable consent that the law requires. We do not track or monitor children's behaviour on the Website and we do not serve targeted advertising to children. If you believe a child has provided personal data to us without such consent, contact us at hello.allthingsclassroom@gmail.com and we will delete it promptly.

2.1 To operate and deliver our services

• Respond to enquiries and arrange a first conversation, demonstration or session;
• Plan, schedule and run programmes, sessions, workshops and events, including online sessions;
• Raise invoices, take payment and keep the records the law requires;
• Send transactional messages — confirmations, session links, schedules, receipts and notices about your booking.

2.2 To communicate with you

• Send our newsletter and educational content, where you have subscribed or otherwise consented (you can unsubscribe at any time);
• Tell you about changes to our programmes, services or this Policy;
• Invite you to events, sessions and community activities.

2.3 To improve our services

• Understand how the Website is used so that we can improve its content and experience;
• Understand what parents, educators and schools are looking for, so we can design better programmes;
• Keep the Website secure and detect and prevent abuse.

2.4 For legal and compliance purposes

• Comply with applicable laws, regulations and legal obligations, including tax and accounting requirements;
• Enforce our Terms and Conditions and other agreements;
• Detect, prevent and investigate fraud, abuse and security incidents;
• Respond to lawful requests from courts, law-enforcement and regulatory authorities.

We process personal data under the Digital Personal Data Protection Act, 2023 on the basis of:

• Consent — given by you (or, for a child, by a parent or guardian) when you enquire, register, subscribe or allow non-essential cookies. Consent can be withdrawn at any time, and withdrawal does not affect processing that took place before it;
• Legitimate uses recognised by the Act — for example where you have voluntarily provided your data for a specified purpose, or where processing is needed to comply with a law, a court order or a legal obligation.

For visitors in the European Economic Area or the United Kingdom, we rely on the corresponding bases under the GDPR and UK GDPR: performance of a contract, our legitimate interests (running and securing the Website, responding to enquiries), consent (marketing, non-essential cookies) and legal obligation. See section 11.

4.1 What cookies are

Cookies are small text files placed on your device by a website. Similar technologies include local storage and pixels. We keep our own use to a minimum, and we ask before loading anything that is not essential.

4.2 What we use

• Essential — needed for the Website to work: your cookie choice itself, and the enquiry form provided by Tally. These cannot be switched off.
• Functional — set only when you use a feature: for example, YouTube may set cookies when you press play on a video (we use YouTube's privacy-enhanced mode, which does not set cookies until you play).
• Embedded content — with your permission, we load Instagram's embed script to show our posts on the Website. Instagram (Meta Platforms) may then set its own cookies. If you choose "Essential only", we show a link to the post instead.
• Analytics — we do not currently use analytics or advertising cookies. If we introduce an analytics tool, we will ask for your consent first and update this Policy.

4.3 Your choices

When you first visit, a banner lets you choose Accept all or Essential only. You can change your mind at any time using the "Cookie settings" link in the footer, or by clearing cookies in your browser. Disabling essential cookies may stop parts of the Website working.

We do not sell personal data. We share it only in the circumstances below.

5.1 Service providers

We use trusted providers who process data on our behalf, only for the purposes described in this Policy and under contracts that require them to protect it:

• Tally (Tally BV, Belgium) — the enquiry form on the Website;
• beehiiv (beehiiv Inc., USA) — our newsletter;
• Google (Google LLC, USA) — YouTube video embedding, Google Workspace email and Google Drive for programme resources;
• Meta Platforms (USA) — Instagram embeds, where you have allowed them;
• Vercel (Vercel Inc., USA) or an equivalent provider — hosting for the Website;
• Video-conferencing and payment providers — for online sessions and invoices; the specific provider is named in your booking or invoice.

5.2 Schools and institutions

Where a school or organisation engages us for a programme, we share attendance, progress and feedback about its learners with that school or organisation, as agreed with it.

5.3 Legal requirements and protection

We may disclose information where we believe it is necessary to comply with a law, court order or lawful request from a government or regulatory authority; to protect the rights, property or safety of All Things Classroom, our learners or the public; to investigate fraud or security incidents; or to enforce our Terms and Conditions.

5.4 Business transfers

If we are involved in a merger, acquisition, reorganisation or sale of assets, personal data may be transferred to the successor entity. We will notify you of any such transfer and of any material change to this Policy.

5.5 Aggregated data

We may share aggregated or anonymised data that cannot reasonably identify you — for example, how many learners took part in a programme.

We are based in India. Some of the providers listed above store data outside India (for example in the United States or the European Union). We transfer personal data only to countries that are not restricted under the Digital Personal Data Protection Act, 2023 and the rules made under it, and we require our providers to protect it to a standard consistent with this Policy. For visitors from the EEA or UK, transfers to India and other countries are made under appropriate safeguards such as standard contractual clauses (see section 11).

We keep personal data only for as long as it is needed for the purposes described here, unless a longer period is required or permitted by law:

• Enquiries that do not lead to a programme — up to 12 months from the last communication;
• Programme, booking and learner records — for the duration of the programme and up to 3 years afterwards, so that we can respond to questions and provide references;
• Invoices, payment and tax records — a minimum of 8 years, as required by the Companies Act, 2013 and applicable tax law;
• Newsletter data — until you unsubscribe or ask us to delete it;
• Server logs — as retained by our hosting provider, typically a short period.

When the retention period ends we delete the data or anonymise it.

We follow reasonable security practices and procedures within the meaning of section 43A of the Information Technology Act, 2000 and the rules under it, including:

• Encryption (HTTPS/TLS) for all data sent between your browser and the Website;
• Access to personal data restricted to the people who need it, using accounts with multi-factor authentication;
• Reputable providers for forms, email, hosting and payments, each responsible for the security of their own systems;
• Periodic review of what we hold and why.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs that is likely to affect you, we will notify you and the Data Protection Board of India as the law requires.

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• Access — obtain a summary of the personal data we hold about you and how it has been used and shared;
• Correction and erasure — have inaccurate or incomplete data corrected, and have data erased when it is no longer needed for the purpose it was collected for;
• Withdraw consent — at any time, as easily as you gave it;
• Grievance redressal — raise a complaint with our Grievance Officer (section 13) and, if you are not satisfied with our response, with the Data Protection Board of India;
• Nominate — name another person to exercise these rights on your behalf if you are unable to.

To exercise any of these rights, email hello.allthingsclassroom@gmail.com. We may need to verify your identity before acting. We do not charge a fee, and we respond within the time the law allows and in any case within 30 days.

With your consent we send our newsletter and occasional updates about programmes and events. Every marketing email includes an unsubscribe link. You can also opt out by emailing hello.allthingsclassroom@gmail.com; please allow up to 10 business days for the change to take effect. Transactional messages about a booking or programme you are taking part in may continue after you opt out of marketing.

Our programmes are designed to meet the requirements of the EU General Data Protection Regulation (GDPR) and the UK GDPR for the learners, educators and schools we work with there. If you are in the European Economic Area or the United Kingdom:

• We act as the controller of personal data collected through the Website. Where a school engages us and provides learner data, we act as its processor under a written agreement.
• In addition to the rights in section 9, you have the rights of restriction, objection and data portability, and the right not to be subject to solely automated decisions with legal or similarly significant effects (we make none).
• Transfers to India and to our providers elsewhere are made under standard contractual clauses or your explicit consent, and we assess each provider's safeguards.
• You may lodge a complaint with your local supervisory authority (for example the ICO in the UK), although we would welcome the chance to address your concern first.

The Website links to third-party websites and platforms — including YouTube, Instagram, LinkedIn, beehiiv, Google Drive and the sources cited in our blog. This Policy applies only to information collected by us. We are not responsible for the privacy practices of other sites and encourage you to read their policies.

In accordance with the Information Technology Act, 2000, the rules made under it and the Digital Personal Data Protection Act, 2023, questions, requests and grievances about this Policy or about your personal data may be sent to our Grievance Officer:

Shriyayai Coaching and Consulting Services Pvt Ltd (trading as All Things Classroom) Attn: Grievance Officer — Data & Compliance 80 Feet Rd, Koramangala 1A Block, Bengaluru, Karnataka 560034, India Email: hello.allthingsclassroom@gmail.com Website: www.allthingsclassroom.com

We acknowledge grievances within 48 hours and aim to resolve them within 30 days of receipt.

We may update this Policy from time to time. When we make material changes we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or with a notice on the Website. Continued use of the Website after a change means you accept the updated Policy.